Skip to main content
An agent record identifies the actor. A linked OAuth machine client authenticates with its own signing key, and an approved resource grant defines its authority. Creating or linking a client does not approve access by itself. For onboarding, register the client, bind it to the intended agent, register its public JWK, complete proof of possession and obtain the exact resource/scopes grant in the correct organization and environment. Keep the private key locally or in a signing service. The client signs an assertion for the configured token endpoint; the resulting access token is used at the protected resource. Use distinct clients and narrow grants where workloads need different authority. Scopes are explicit: a write scope does not automatically include a read scope. The resource server must validate the token’s issuer, audience and required scopes. Use MachineAgent.from_env() for the same workflow in sandbox and production. Server eligibility checks apply to the selected environment. See Quickstart and Configuration.